Wide Open Firewall: Critical Foomuuri Flaws Let Local Users Take Control

According to SUSE Security Team, Foomuuri, a nftables-based firewall manager for Linux, contained multiple flaws that left its D-Bus interface wide open to local attackers who could alter network zones and weaken or destabilise security. The most severe issue, CVE-2025-67603, allowed any local user to invoke the root-running D-Bus service without client authentication, after which they could change firewall configuration though not rewrite the entire rule set.

A second flaw, CVE-2025-67858, involved how user input was handled, permitting arbitrary strings to be passed as interface names and potentially enabling log spoofing and other abuses. The researchers warned that a skilled attacker could embed additional JSON in the interface parameter to influence the underlying configuration, risking loss of integrity in the firewall rules.

Following a coordinated disclosure, Foomuuri version 0.31, released on 7 January 2026, addresses these issues by enforcing Polkit authentication, tightening input verification, and applying hardening measures such as ProtectSystem=full; users are urged to upgrade to 0.31 immediately to secure their systems.